Search for: All records

Black hat hackers use malicious exploits to circumvent security controls and take advantage of system vulnerabilities worldwide, costing the global economy over $450 billion annually. While many organizations are increasingly turning to cyber threat intelligence (CTI) to help prioritize their vulnerabilities, extant CTI processes are often criticized as being reactive to known exploits. One promising data source that can help develop proactive CTI is the vast and ever-evolving Dark Web. In this study, we adopted the computational design science paradigm to design a novel deep learning (DL)-based exploit-vulnerability attention deep structured semantic model (EVA-DSSM) that includes bidirectional processing and attention mechanisms to automatically link exploits from the Dark Web to vulnerabilities. We also devised a novel device vulnerability severity metric (DVSM) that incorporates the exploit post date and vulnerability severity to help cybersecurity professionals with their device prioritization and risk management efforts. We rigorously evaluated the EVA-DSSM against state-of-the-art non-DL and DL-based methods for short text matching on 52,590 exploit-vulnerability linkages across four testbeds: web application, remote, local, and denial of service. Results of these evaluations indicate that the proposed EVA-DSSM achieves precision at 1 scores 20% - 41% higher than non-DL approaches and 4% - 10% higher than DL-based approaches. We demonstrated the EVA-DSSM’s and DVSM’s practical utility with two CTI case studies: openly accessible systems in the top eight U.S. hospitals and over 20,000 Supervisory Control and Data Acquisition (SCADA) systems worldwide. A complementary user evaluation of the case study results indicated that 45 cybersecurity professionals found the EVA-DSSM and DVSM results more useful for exploit-vulnerability linking and risk prioritization activities than those produced by prevailing approaches. Given the rising cost of cyberattacks, the EVA-DSSM and DVSM have important implications for analysts in security operations centers, incident response teams, and cybersecurity vendors. 

Black hat hackers use malicious exploits to circumvent security controls and take advantage of system vulnerabilities worldwide, costing the global economy over $450 billion annually. While many organizations are increasingly turning to cyber threat intelligence (CTI) to help prioritize their vulnerabilities, extant CTI processes are often criticized as being reactive to known exploits. One promising data source that can help develop proactive CTI is the vast and ever-evolving Dark Web. In this study, we adopted the computational design science paradigm to design a novel deep learning (DL)-based exploit-vulnerability attention deep structured semantic model (EVA-DSSM) that includes bidirectional processing and attention mechanisms to automatically link exploits from the Dark Web to vulnerabilities. We also devised a novel device vulnerability severity metric (DVSM) that incorporates the exploit post date and vulnerability severity to help cybersecurity professionals with their device prioritization and risk management efforts. We rigorously evaluated the EVA-DSSM against state-of-the-art non-DL and DL-based methods for short text matching on 52,590 exploit-vulnerability linkages across four testbeds: web application, remote, local, and denial of service. Results of these evaluations indicate that the proposed EVA-DSSM achieves precision at 1 scores 20%-41% higher than non-DL approaches and 4%-10% higher than DL-based approaches. We demonstrated the EVA-DSSM's and DVSM's practical utility with two CTI case studies: openly accessible systems in the top eight U.S. hospitals and over 20,000 Supervisory Control and Data Acquisition (SCADA) systems worldwide. A complementary user evaluation of the case study results indicated that 45 cybersecurity professionals found the EVA-DSSM and DVSM results more useful for exploit-vulnerability linking and risk prioritization activities than those produced by prevailing approaches. Given the rising cost of cyberattacks, the EVA-DSSM and DVSM have important implications for analysts in security operations centers, incident response teams, and cybersecurity vendors. 

International dark web platforms operating within multiple geopolitical regions and languages host a myriad of hacker assets such as malware, hacking tools, hacking tutorials, and malicious source code. Cybersecurity analytics organizations employ machine learning models trained on human-labeled data to automatically detect these assets and bolster their situational awareness. However, the lack of human-labeled training data is prohibitive when analyzing foreign-language dark web content. In this research note, we adopt the computational design science paradigm to develop a novel IT artifact for cross-lingual hacker asset detection(CLHAD). CLHAD automatically leverages the knowledge learned from English content to detect hacker assets in non-English dark web platforms. CLHAD encompasses a novel Adversarial deep representation learning (ADREL) method, which generates multilingual text representations using generative adversarial networks (GANs). Drawing upon the state of the art in cross-lingual knowledge transfer, ADREL is a novel approach to automatically extract transferable text representations and facilitate the analysis of multilingual content. We evaluate CLHAD on Russian, French, and Italian dark web platforms and demonstrate its practical utility in hacker asset profiling, and conduct a proof-of-concept case study. Our analysis suggests that cybersecurity managers may benefit more from focusing on Russian to identify sophisticated hacking assets. In contrast, financial hacker assets are scattered among several dominant dark web languages. Managerial insights for security managers are discussed at operational and strategic levels. 

The regularity of devastating cyber-attacks has made cybersecurity a grand societal challenge. Many cybersecurity professionals are closely examining the international Dark Web to proactively pinpoint potential cyber threats. Despite its potential, the Dark Web contains hundreds of thousands of non-English posts. While machine translation is the prevailing approach to process non-English text, applying MT on hacker forum text results in mistranslations. In this study, we draw upon Long-Short Term Memory (LSTM), Cross-Lingual Knowledge Transfer (CLKT), and Generative Adversarial Networks (GANs) principles to design a novel Adversarial CLKT (A-CLKT) approach. A-CLKT operates on untranslated text to retain the original semantics of the language and leverages the collective knowledge about cyber threats across languages to create a language invariant representation without any manual feature engineering or external resources. Three experiments demonstrate how A-CLKT outperforms state-of-the-art machine learning, deep learning, and CLKT algorithms in identifying cyber-threats in French and Russian forums. 

ABSTRACT The dwarf spheroidal galaxies (dSphs) orbiting the Milky Way are widely regarded as systems supported by velocity dispersion against self-gravity, and as prime targets for the search for indirect dark matter (DM) signatures in the GeV-to-TeV $$\gamma$$-ray range owing to their lack of astrophysical $$\gamma$$-ray background. We present forecasts of the sensitivity of the forthcoming Cherenkov Telescope Array Observatory (CTAO) to annihilating or decaying DM signals in these targets. An original selection of candidates is performed from the current catalogue of known objects, including both classical and ultrafaint dSphs. For each, the expected DM content is derived using the most comprehensive photometric and spectroscopic data available, within a consistent framework of analysis. This approach enables the derivation of novel astrophysical factor profiles for indirect DM searches, which are compared with results from the literature. From an initial sample of 64 dSphs, eight promising targets are identified – Draco I, Coma Berenices, Ursa Major II, Ursa Minor, and Willman 1 in the North, Reticulum II, Sculptor, and Sagittarius II in the South – for which different DM density models yield consistent expectations, leading to robust predictions. CTAO is expected to provide the strongest limits above $$\sim$$10 TeV, reaching velocity-averaged annihilation cross sections of $$\sim 5\times 10^{-25}$$ cm$^3$ s$$^{-1}$$ and decay lifetimes up to $$\sim 10^{26}$$ s for combined limits. The dominant uncertainties arise from the imprecise determination of the DM content, particularly for ultrafaint dSphs. Observation strategies are proposed that optimize either deep exposures of the best candidates or diversified target selections. 

Abstract Dwarf spheroidal galaxies (dSphs) are excellent targets for indirect dark matter (DM) searches using gamma-ray telescopes because they are thought to have high DM content and a low astrophysical background. The sensitivity of these searches is improved by combining the observations of dSphs made by different gamma-ray telescopes. We present the results of a combined search by the most sensitive currently operating gamma-ray telescopes, namely: the satellite-borneFermi-LAT telescope; the ground-based imaging atmospheric Cherenkov telescope arrays H.E.S.S., MAGIC, and VERITAS; and the HAWC water Cherenkov detector. Individual datasets were analyzed using a common statistical approach. Results were subsequently combined via a global joint likelihood analysis. We obtain constraints on the velocity-weighted cross section 〈σv〉 for DM self-annihilation as a function of the DM particle mass. This five-instrument combination allows the derivation of up to 2-3 times more constraining upper limits on 〈σv〉 than the individual results over a wide mass range spanning from 5 GeV to 100 TeV. Depending on the DM content modeling, the 95% confidence level observed limits reach 1.5×10^-24 cm³s^-1and 3.2×10^-25 cm³s^-1, respectively, in theτ⁺τ^-annihilation channel for a DM mass of 2 TeV. 

Aims.Mrk 421 was in its most active state around early 2010, which led to the highest TeV gamma-ray flux ever recorded from any active galactic nuclei (AGN). We aim to characterize the multiwavelength behavior during this exceptional year for Mrk 421, and evaluate whether it is consistent with the picture derived with data from other less exceptional years. Methods.We investigated the period from November 5, 2009, (MJD 55140) until July 3, 2010, (MJD 55380) with extensive coverage from very-high-energy (VHE;E > 100 GeV) gamma rays to radio with MAGIC, VERITAS,Fermi-LAT,RXTE,Swift, GASP-WEBT, VLBA, and a variety of additional optical and radio telescopes. We characterized the variability by deriving fractional variabilities as well as power spectral densities (PSDs). In addition, we investigated images of the jet taken with VLBA and the correlation behavior among different energy bands. Results.Mrk 421 was in widely different states of activity throughout the campaign, ranging from a low-emission state to its highest VHE flux ever recorded. We find the strongest variability in X-rays and VHE gamma rays, and PSDs compatible with power-law functions with indices around 1.5. We observe strong correlations between X-rays and VHE gamma rays at zero time lag with varying characteristics depending on the exact energy band. We also report a marginally significant (∼3σ) positive correlation between high-energy (HE;E > 100 MeV) gamma rays and the ultraviolet band. We detected marginally significant (∼3σ) correlations between the HE and VHE gamma rays, and between HE gamma rays and the X-ray, that disappear when the large flare in February 2010 is excluded from the correlation study, hence indicating the exceptionality of this flaring event in comparison with the rest of the campaign. The 2010 violent activity of Mrk 421 also yielded the first ejection of features in the VLBA images of the jet of Mrk 421. Yet the large uncertainties in the ejection times of these unprecedented radio features prevent us from firmly associating them to the specific flares recorded during the 2010 campaign. We also show that the collected multi-instrument data are consistent with a scenario where the emission is dominated by two regions, a compact and extended zone, which could be considered as a simplified implementation of an energy-stratified jet as suggested by recentIXPEobservations. 

ABSTRACT OT 081 is a well-known, luminous blazar that is remarkably variable in many energy bands. We present the first broadband study of the source, which includes very high energy (VHE, $$E\gt $$ 100 GeV) $$\gamma$$-ray data taken by the MAGIC (Major Atmospheric Gamma-ray Imaging Cherenkov telescopes) and H.E.S.S. (High Energy Stereoscopic System) imaging Cherenkov telescopes. The discovery of VHE $$\gamma$$-ray emission happened during a high state of $$\gamma$$-ray activity in July 2016, observed by many instruments from radio to VHE $$\gamma$$-rays. We identify four states of activity of the source, one of which includes VHE $$\gamma$$-ray emission. Variability in the VHE domain is found on daily time-scales. The intrinsic VHE spectrum can be described by a power law with index $$3.27\pm 0.44_{\rm stat}\pm 0.15_{\rm sys}$$ (MAGIC) and $$3.39\pm 0.58_{\rm stat}\pm 0.64_{\rm sys}$$ (H.E.S.S.) in the energy range of 55–300 and 120–500 GeV, respectively. The broadband emission cannot be successfully reproduced by a simple one-zone synchrotron self-Compton model. Instead, an additional external Compton component is required. We test a lepto-hadronic model that reproduces the data set well and a proton-synchrotron-dominated model that requires an extreme proton luminosity. Emission models that are able to successfully represent the data place the emitting region well outside of the broad-line region to a location at which the radiative environment is dominated by the infrared thermal radiation field of the dusty torus. In the scenario described by this flaring activity, the source appears to be a flat spectrum radio quasar (FSRQ), in contrast with past categorizations. This suggests that the source can be considered to be a transitional blazar, intermediate between BL Lac and FSRQ objects. 

The BL Lacertae object VER J0521+211 underwent a notable flaring episode in February 2020. A short-term monitoring campaign, led by the MAGIC (Major Atmospheric Gamma Imaging Cherenkov) collaboration, covering a wide energy range from radio to very high-energy (VHE, 100 GeV <E< 100 TeV) gamma rays was organised to study its evolution. These observations resulted in a consistent detection of the source over six consecutive nights in the VHE gamma-ray domain. Combining these nightly observations with an extensive set of multi-wavelength data made modelling of the blazar’s spectral energy distribution (SED) possible during the flare. This modelling was performed with a focus on two plausible emission mechanisms: (i) a leptonic two-zone synchrotron-self-Compton scenario, and (ii) a lepto-hadronic one-zone scenario. Both models effectively replicated the observed SED from radio to the VHE gamma-ray band. Furthermore, by introducing a set of evolving parameters, both models were successful in reproducing the evolution of the fluxes measured in different bands throughout the observing campaign. Notably, the lepto-hadronic model predicts enhanced photon and neutrino fluxes at ultra-high energies (E> 100 TeV). While the photon component, generated via decay of neutral pions, is not directly observable as it is subject to intense pair production (and therefore extinction) through interactions with the cosmic microwave background photons, neutrino detectors (e.g. IceCube) can probe the predicted neutrino component. Finally, the analysis of the gamma-ray spectra, observed by MAGIC and theFermi-LAT telescopes, yielded a conservative 95% confidence upper limit ofz ≤ 0.244 for the redshift of this blazar. 

Context.Blazars exhibit strong variability across the entire electromagnetic spectrum, including periods of high-flux states commonly known as flares. The physical mechanisms in blazar jets responsible for flares remain poorly understood to date. Aims.Our aim is to better understand the emission mechanisms during blazar flares using X-ray polarimetry and broadband observations from the archetypical TeV blazar Mrk 421, which can be studied with higher accuracy than other blazars that are dimmer and/or located farther away. Methods.We studied a flaring activity from December 2023 that was characterized from radio to very high-energy (VHE;E > 0.1 TeV) gamma rays with MAGIC,Fermi-LAT,Swift,XMM-Newton, and several optical and radio telescopes. These observations included, for the first time for a gamma-ray flare of a blazar, simultaneous X-ray polarization measurements with IXPE, in addition to optical and radio polarimetry data. We quantify the variability and correlations among the multi-band flux and polarization measurements, and describe the varying broadband emission within a theoretical scenario constrained by the polarization data. Results.We find substantial variability in both X-rays and VHE gamma rays throughout the campaign, with the highest VHE flux above 0.2 TeV occurring during the IXPE observing window, and exceeding twice the flux of the Crab Nebula. However, the VHE and X-ray spectra are on average softer, and the correlation between these two bands is weaker than those reported in the previous flares of Mrk 421. IXPE reveals an X-ray polarization degree significantly higher than that at radio and optical frequencies, similar to previous results for Mrk 421 and other high synchrotron peaked blazars. Differently to past observations, the X-ray polarization angle varies by ∼100° on timescales of days, and the polarization degree changes by more than a factor of 4. The highest X-ray polarization degree, analyzed in 12 h time intervals, reaches 26 ± 2%, around which an X-ray counter-clockwise hysteresis loop is measured withXMM-Newton. It suggests that the X-ray emission comes from particles close to the high-energy cutoff, hence possibly probing an extreme case of the Turbulent Extreme Multi-Zone model for which the chromatic trend in the polarization may be more pronounced than theoretically predicted. We model the broadband emission with a simplified stratified jet model throughout the flare. The polarization measurements imply an electron distribution in the X-ray emitting region with a very high minimum Lorentz factor ($$ \gamma\prime_{\mathrm{min}}\gtrsim10^4 $$), which is expected in electron-ion plasma, as well as a variation of the emitting region size of up to a factor of 3 during the flaring activity. We find no correlation between the fluxes and the evolution of the model parameters, which indicates a stochastic nature of the underlying physical mechanism that likely explains the lack of a tight X-ray/VHE correlation during this flaring activity. Such behavior would be expected in a highly turbulent electron-ion plasma crossing a shock front.